[feature] use internal services to check for acl on exports

src/Bundle/ChillMainBundle/Controller/ExportController.php

@@ -23,6 +23,7 @@ use Symfony\Component\Form\Extension\Core\Type\FormType;
 use Symfony\Component\Form\Extension\Core\Type\SubmitType;
 use Symfony\Component\Form\FormFactoryInterface;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\Session\SessionInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
@@ -142,10 +143,8 @@ class ExportController extends AbstractController
 
     /**
      * Render the list of available exports.
-     *
-     * @return \Symfony\Component\HttpFoundation\Response
      */
-    public function indexAction(Request $request)
+    public function indexAction(): Response
     {
         $exportManager = $this->exportManager;
 

src/Bundle/ChillMainBundle/Export/ExportManager.php

@@ -14,6 +14,7 @@ namespace Chill\MainBundle\Export;
 use Chill\MainBundle\Form\Type\Export\ExportType;
 use Chill\MainBundle\Form\Type\Export\PickCenterType;
 use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
+use Chill\MainBundle\Security\Authorization\AuthorizationHelperInterface;
 use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\ORM\QueryBuilder;
 use Generator;
@@ -42,52 +43,38 @@ class ExportManager
     /**
      * The collected aggregators, injected by DI.
      *
-     * @var AggregatorInterface[]
+     * @var array|AggregatorInterface[]
      */
-    private $aggregators = [];
+    private array $aggregators = [];
 
-    /**
+    private AuthorizationCheckerInterface $authorizationChecker;
-     * @var AuthorizationChecker
-     */
-    private $authorizationChecker;
 
-    /**
+    private AuthorizationHelperInterface $authorizationHelper;
-     * @var AuthorizationHelper
-     */
-    private $authorizationHelper;
 
-    /**
+    private EntityManagerInterface $em;
-     * @var EntityManagerInterface
-     */
-    private $em;
 
     /**
      * Collected Exports, injected by DI.
      *
-     * @var ExportInterface[]
+     * @var array|ExportInterface[]
      */
-    private $exports = [];
+    private array $exports = [];
 
     /**
      * The collected filters, injected by DI.
      *
-     * @var FilterInterface[]
+     * @var array|FilterInterface[]
      */
-    private $filters = [];
+    private array $filters = [];
 
     /**
      * Collected Formatters, injected by DI.
      *
-     * @var FormatterInterface[]
+     * @var array|FormatterInterface[]
      */
-    private $formatters = [];
+    private array $formatters = [];
 
-    /**
+    private LoggerInterface $logger;
-     * a logger.
-     *
-     * @var LoggerInterface
-     */
-    private $logger;
 
     /**
      * @var \Symfony\Component\Security\Core\User\UserInterface
@@ -98,7 +85,7 @@ class ExportManager
         LoggerInterface $logger,
         EntityManagerInterface $em,
         AuthorizationCheckerInterface $authorizationChecker,
-        AuthorizationHelper $authorizationHelper,
+        AuthorizationHelperInterface $authorizationHelper,
         TokenStorageInterface $tokenStorage
     ) {
         $this->logger = $logger;
@@ -547,19 +534,16 @@ class ExportManager
                     . 'an ExportInterface.');
         }
 
-        if (null === $centers) {
+        if (null === $centers || [] === $centers) {
-            $centers = $this->authorizationHelper->getReachableCenters(
+            // we want to try if at least one center is reachable
+            return [] !== $this->authorizationHelper->getReachableCenters(
                 $this->user,
                 $role
             );
         }
 
-        if (count($centers) === 0) {
-            return false;
-        }
-
         foreach ($centers as $center) {
-            if ($this->authorizationChecker->isGranted($role, $center) === false) {
+            if (false === $this->authorizationChecker->isGranted($role, $center)) {
                 //debugging
                 $this->logger->debug('user has no access to element', [
                     'method' => __METHOD__,
@@ -568,10 +552,6 @@ class ExportManager
                     'role' => $role,
                 ]);
 
-                ///// Bypasse les autorisations qui empêche d'afficher les nouveaux exports
-                return true;
-                ///// TODO supprimer le return true
-
                 return false;
             }
         }

src/Bundle/ChillMainBundle/Repository/CenterRepository.php

@@ -30,6 +30,18 @@ final class CenterRepository implements ObjectRepository
         return $this->repository->find($id, $lockMode, $lockVersion);
     }
 
+    /**
+     * Return all active centers
+     *
+     * Note: this is a teaser: active will comes later on center entity
+     *
+     * @return Center[]
+     */
+    public function findActive(): array
+    {
+        return $this->findAll();
+    }
+
     /**
      * @return Center[]
      */

src/Bundle/ChillMainBundle/Security/Authorization/ChillExportVoter.php

@@ -19,24 +19,23 @@ class ChillExportVoter extends Voter
 {
     public const EXPORT = 'chill_export';
 
-    protected AuthorizationHelperInterface $authorizationHelper;
+    private VoterHelperInterface $helper;
 
-    public function __construct(AuthorizationHelperInterface $authorizationHelper)
+    public function __construct(VoterHelperFactoryInterface $voterHelperFactory)
     {
-        $this->authorizationHelper = $authorizationHelper;
+        $this->helper = $voterHelperFactory
+            ->generate(self::class)
+            ->addCheckFor(null, [self::EXPORT])
+            ->build();
     }
 
     protected function supports($attribute, $subject): bool
     {
-        return self::EXPORT === $attribute;
+        return $this->helper->supports($attribute, $subject);
     }
 
     protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
     {
-        if (!$token->getUser() instanceof User) {
+        return $this->helper->voteOnAttribute($attribute, $subject, $token);
-            return false;
-        }
-
-        return [] !== $this->authorizationHelper->getReachableCenters($token->getUser(), $attribute);
     }
 }

src/Bundle/ChillMainBundle/config/services.yaml

@@ -88,12 +88,8 @@ services:
             - { name: validator.constraint_validator, alias: 'role_scope_scope_presence' }
 
     Chill\MainBundle\Export\ExportManager:
-        arguments:
+        autoconfigure: true
-            - "@logger"
+        autowire: true
-            - "@doctrine.orm.entity_manager"
-            - "@security.authorization_checker"
-            - "@chill.main.security.authorization.helper"
-            - "@security.token_storage"
 
     Chill\MainBundle\Security\Resolver\CenterResolverDispatcherInterface: '@Chill\MainBundle\Security\Resolver\CenterResolverDispatcher'